Smartphones and Tablets: Policy for Company and Personal Devices

Smartphones and tablets are more easily lost than an office computer and are used in places the company does not control (NIST SP 800-124 Rev. 2, 3.1.2). The IT-Grundschutz Compendium of the German BSI (Edition 2023) sets out a basic requirement: before an institution uses smartphones or tablets, it MUST define a policy for the use and control of the devices, including who may access which information with them (SYS.3.2.1.A1). The module applies to all devices used for work; its threat landscape explicitly also mentions personal devices (BYOD).

A binding policy for employees SHOULD govern use, care, storage, and loss reporting and prohibit removing management software, rooting the device, or changing security settings (SYS.3.2.1.A10). Anyone who uses mobile device management (MDM) MUST define a written strategy that also governs the operating model: personal devices, personally assigned or shared company devices (SYS.3.2.2.A1).

Mandatory or recommended? In Austria, IT-Grundschutz and NIST are not laws but recognized standards. The BSI divides requirements into basic (B), standard (S), and requirements for elevated protection needs (H); within each requirement, MUST is to be met unconditionally, and SHOULD may only be deviated from after careful consideration and with sound justification. The template is a TOMORIS recommendation. The main legal requirements to observe are the GDPR, the ArbVG, and the AVRAG (section 03), and for NIS2 entities also § 32 para. 4 lit. i NISG 2026 (section 06).

For BYOD, the BSI warns that a wipe via MDM can also affect personal data and that company data may be viewed without authorization during a repair or remain on the device in an unregulated way upon departure (SYS.3.2.1, threat 2.9). TOMORIS recommendation: for personal devices, app protection policies are sufficient in many SMEs; enrollment is worthwhile if certificates, Wi-Fi, or VPN profiles are needed. According to NIST, very restrictive requirements or requirements that appear to be monitoring can tempt employees to resort to shadow IT (3.1.13).

With app protection policies and the Android work profile, administrators, according to Microsoft, can neither read nor delete data that belongs to or is controlled by the users. The table shows what the organization sees for a device enrolled in Intune; for other MDM products, check the vendor's information.

For HR: control measures and technical systems for monitoring employees that affect human dignity require the consent of the works council (§ 96 para. 1 no. 3 ArbVG). Systems that collect, process, or transmit employee data by automated means beyond general personal information and professional qualifications also require its consent, insofar as their use goes beyond obligations arising from law, collective agreements, or the employment contract; this consent can be replaced by the arbitration board (§ 96a para. 1 no. 1 and para. 2 ArbVG). Without a works council, control measures that affect human dignity are only permitted with the consent of the employee (§ 10 para. 1 AVRAG). Whether this applies to your configuration must be clarified case by case; this note does not replace legal advice.

Before enrollment, provide information on purposes and legal basis, recipients, and retention period (Art. 13(1)(c) and (e) and (2)(a) GDPR), name the device data collected, and collect only what is necessary (Art. 5(1)(c) GDPR). According to NIST, location data should only be used with consent and a clear description (3.1.11); geofencing creates movement profiles and can be misused for impermissible monitoring (BSI SYS.3.2.2, threat 2.4).

The BSI does not specify concrete values such as the lock time or passcode length; the model text contains TOMORIS suggestions for these. On personal devices without enrollment, app protection policies check, for example, the minimum operating system version, jailbreak or root, and on Android the device lock when the company app starts, and otherwise block access (Microsoft, data protection framework).

1. 1

   Clarify licenses and roles

   App protection policies: one Microsoft Entra account per user with an assigned Intune license; for Outlook, additionally an Exchange Online mailbox with a Microsoft 365 license, for Word, Excel, and PowerPoint Microsoft 365 Apps for Business or Enterprise. App-based Conditional Access: Microsoft Entra ID P1 or P2, also for the users covered; Security Administrators and Conditional Access Administrators can set it up.

2. 2

   Create app protection policies

   In the Microsoft Intune admin center, one policy each for iOS/iPadOS and Android. For most mobile users, Microsoft recommends level 2 of its data protection framework: encrypt organization data, PIN, block backups, copies only in OneDrive for Business, SharePoint, and the photo library, cut and copy only into managed apps (pasting into company apps remains allowed), minimum operating system version, delete company data after 30 days offline, block jailbroken or rooted devices.

3. 3

   Require Conditional Access

   Only once the app protection policies apply: in the Microsoft Entra admin center under Entra ID › Conditional Access › Policies, require the grant "Require app protection policy" for all users and resources on Android and iOS, exclude an emergency account, and test first in "Report-only" mode. "Require approved client app" has been read-only since June 30, 2026: policies using it can no longer be created or edited, only disabled or deleted; existing ones continue to work. The devices register in Entra ID via Microsoft Authenticator (iOS) or the Company Portal (Android).

4. 4

   Enroll devices

   Enroll company devices in the MDM in factory state before handing them out (SYS.3.2.2.A4), for example via Apple's automated device enrollment or Android zero-touch (NIST 5.3.4.2). Personal devices via the Android work profile, Apple user enrollment, or only with app protection policies.

Decide on deviations deliberately: the BSI recommends managing smartphones and tablets via MDM (SHOULD, SYS.3.2.1.A32); module SYS.3.2.2 does not cover BYOD. Anyone who secures personal devices only with app protection policies justifies this in a comprehensible way and documents it, for example in the security concept. To enforce app protection policies, Microsoft advises using Conditional Access. Menus and names: Microsoft Learn, October 2026.

Remote wipe alone does not protect: with the built-in tools of iOS and Android, it only works when the device is on and connected, and attackers can extract data beforehand (NIST 4.3.3). Passcode and encryption are the first layer of protection. Never wipe personal devices completely without consent; according to NIST, deleting data that does not belong to the company can cause legal problems (4.3.12).

Upon departure, IT resets returned company devices to factory settings before passing them on. This does not erase SIM and SD cards: remove and erase SD cards, handle SIM cards according to the rules on the phone number; for disposal, NIST recommends removing and destroying both (5.5). After decommissioning, no sensitive data should remain on the device or storage media (SYS.3.2.2.A22).

NIS2 entities: § 32 para. 4 lit. i NISG 2026 requires measures for human resources security, access control, and asset management. This is specified in annex point 12 of Implementing Regulation (EU) 2024/2690, which § 2 NISV 2026 (Austrian NIS Regulation 2026) makes applicable to all essential and important entities: under point 12.5, the handover, return, or deletion of assets such as devices at the end of employment must be regulated and documented; otherwise, they must no longer be able to access the systems.

Replace the placeholders in square brackets, choose one option where alternatives are separated by |, and delete what does not apply; in variant A (company devices only), § 6 is omitted. Numbers such as [5] minutes are TOMORIS suggestions ([30] days offline is Microsoft's value from level 2); rules without a citation are organizational additions by TOMORIS. Coordinate the text with data protection, HR, and, if there is one, the works council.

• Take stock of which devices access email, chats, and files today (NIST 5.1.2); decide on variant A or B and on personal use of company devices (SYS.3.2.2.A1).
• Define approved devices and minimum versions, check the update period at procurement (SYS.3.2.2.A2, SYS.3.2.1.A5).
• Check licenses: Microsoft Intune, Microsoft Entra ID P1 or P2.
• Involve HR and the works council, clarify a works agreement or consent (§§ 96, 96a ArbVG, § 10 AVRAG).
• Prepare a privacy notice (Art. 13 GDPR) and adapt the privacy text in the Company Portal.
• Set up app protection policies (level 2), test Conditional Access first in "Report-only" mode, then turn it on.
• Start with a small pilot group, then roll out to everyone (NIST 5.3.6).
• Train employees: phishing, updates, apps from trusted sources, which data is collected (NIST 4.3.10).
• Set up a reporting channel for losses, practice wipe actions on a test device, add to the departure process.
• Review the policy and settings [annually] and before new operating system versions (SYS.3.2.2.A20).

The checklist and model text are TOMORIS recommendations. The obligations cited from the GDPR, ArbVG, and AVRAG are required by law, and for NIS2 entities additionally those from § 32 para. 4 lit. i NISG 2026, § 2 NISV 2026, and annex point 12.5 Implementing Regulation (EU) 2024/2690.